asterisk users - Jul 2015 - Bug in ast_frame_adjust_volume in 12.2.0?

I'm getting a SIGSEGV at ast_slinear_saturated_multiply at the line:

	351             res = (int) *input * *value;

It's called from ast_frame_adjust_volume.

The frame looks like:

(gdb) print *f
$6 = {frametype = AST_FRAME_VOICE, subclass = {integer = 100021, format = {
      id = AST_FORMAT_SLINEAR16, fattr = {format_attr = {
          0 <repeats 64 times>}, rtp_marker_bit = 0 '\000'}}},
datalen = 0,
  samples = 320, mallocd = 1, mallocd_hdr_len = 1076, offset = 64, 
  src = 0x51623b0 "func_jitterbuffer interpolation", data = {ptr =
0x0,
    uint32 = 0, pad = "\000\000\000\000\000\000\000"}, delivery = {
    tv_sec = 1436290187, tv_usec = 304285}, frame_list = {next = 0x0}, 
  flags = 0, ts = 0, len = 0, seqno = 0}

so datalen is 0 and samples nonzero.  ast_frame_adjust_volume, however,
iterates over samples, not datalen.  Is that correct?

What does it mean to have a packet with a zero datalen anyway?

Richard Kenner wrote:
> I'm getting a SIGSEGV at ast_slinear_saturated_multiply at the line:
>
> 351             res = (int) *input * *value;
>
> It's called from ast_frame_adjust_volume.
>
> The frame looks like:
>
> (gdb) print *f $6 = {frametype = AST_FRAME_VOICE, subclass = {integer
> = 100021, format = { id = AST_FORMAT_SLINEAR16, fattr = {format_attr
> = { 0<repeats 64 times>}, rtp_marker_bit = 0 '\000'}}},
datalen = 0,
> samples = 320, mallocd = 1, mallocd_hdr_len = 1076, offset = 64, src
> = 0x51623b0 "func_jitterbuffer interpolation", data = {ptr = 0x0,
> uint32 = 0, pad = "\000\000\000\000\000\000\000"}, delivery = {
> tv_sec = 1436290187, tv_usec = 304285}, frame_list = {next = 0x0},
> flags = 0, ts = 0, len = 0, seqno = 0}
>
> so datalen is 0 and samples nonzero.  ast_frame_adjust_volume,
> however, iterates over samples, not datalen.  Is that correct?
>
> What does it mean to have a packet with a zero datalen anyway?
This is an interpolated frame from func_jitterbuffer. It's part of 
packet loss concealment. What scenario exposed this?

-- 
Joshua Colp
Digium, Inc. | Senior Software Developer
445 Jan Davis Drive NW - Huntsville, AL 35806 - US
Check us out at: www.digium.com & www.asterisk.org

> This is an interpolated frame from func_jitterbuffer. It's part of 
> packet loss concealment. What scenario exposed this?
We were testing for clipping by doing Set(VOLUME(RX)=100) but we were
connecting to a ConfBridge that had a jitterbuffer.  This occurred when
the phone (SIP) hung up.